From ef2207ed725531911f2dcdaaefd7d56bc6746e4a Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Sun, 2 Aug 2026 19:47:07 -0400
Subject: [PATCH] fix(vault): correctly rewrite paths for vault API proxy
 (#149)

---
 CHANGELOG.md                 | 4 ++++
 nodejs/package-lock.json     | 4 ++--
 nodejs/package.json          | 2 +-
 nodejs/utils/vault_broker.js | 2 +-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bc9e532..a512211 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -644,3 +644,7 @@ First tagged release. Establishes the `vX.Y.Z` tag convention that the in-app up
 [1.1.2]: https://github.com/theta42/sso-manager-node/compare/v1.1.1...v1.1.2
 [1.1.1]: https://github.com/theta42/sso-manager-node/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/theta42/sso-manager-node/releases/tag/v1.1.0
+
+## [1.19.6] - 2026-08-02
+### Fixed
+- Fixed Vault API returning 403 on the Secrets List due to `http-proxy-middleware` v2 rewriting the path incorrectly (it previously appended the `/api/vault/` mount path to the proxied Vault request).
diff --git a/nodejs/package-lock.json b/nodejs/package-lock.json
index 6251884..bd68997 100644
--- a/nodejs/package-lock.json
+++ b/nodejs/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.19.5",
+  "version": "1.19.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "t42-sso-manager",
-      "version": "1.19.5",
+      "version": "1.19.6",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
diff --git a/nodejs/package.json b/nodejs/package.json
index 70f3518..9fcf4a6 100755
--- a/nodejs/package.json
+++ b/nodejs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.19.5",
+  "version": "1.19.6",
   "description": "A very simple LDAP management and SSO system",
   "author": [
     {
diff --git a/nodejs/utils/vault_broker.js b/nodejs/utils/vault_broker.js
index 430c054..b065c62 100644
--- a/nodejs/utils/vault_broker.js
+++ b/nodejs/utils/vault_broker.js
@@ -202,7 +202,7 @@ function vaultProxy() {
 	return createProxyMiddleware({
 		target: VAULT_ADDR,
 		changeOrigin: true,
-		pathRewrite: { '^/': '/v1/' },
+		pathRewrite: { '^/api/vault': '/v1' },
 		on: {
 			proxyReq(proxyReq, req, res, options) {
 				fixRequestBody(proxyReq, req, res, options);